Files
accounted/extensions/general/mcp-server/__tests__/receipt-matcher.test.ts
T
MattssonandClaude Opus 4.7 32d9978f1b Fix/chrome pdf preview csp (#572)
* feat: add option to exclude year-end closing entries in SIE export and related reports

* delete docs

* fix: allow Chrome's PDF viewer in verifikat document preview

The /api/documents/:id/inline route shipped with
`object-src 'none'` in its CSP, which blocked Chrome's built-in PDF
viewer (it renders inline PDFs via an internal <embed>). Users on
Chrome saw "Det här innehållet har blockerats" when expanding a PDF
attachment in the bookkeeping view; Firefox (PDF.js) and Edge (own
viewer) were unaffected, and JPGs worked because <img> isn't subject
to object-src.

Drops the CSP for this route to the minimum needed for embeddability:
`frame-ancestors 'self'`. X-Content-Type-Options: nosniff plus the
fixed Content-Type from the handler already block MIME confusion;
X-Frame-Options: SAMEORIGIN + frame-ancestors still block clickjacking.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(auth): add webmail deep link to email confirmation screens

Mirrors Stripe's signup UX: after asking the user to verify their email,
detect their webmail provider from the domain and show a button that
opens the inbox in a new tab. Gmail gets a from:<sender> search
pre-populated; Outlook/Yahoo/iCloud/Proton open the inbox directly.
Unknown / custom domains fall back to the existing copy.

Sender address is configurable via NEXT_PUBLIC_BRANDING_AUTH_EMAIL_FROM
(default noreply@gnubok.se) so white-label installs can match their
Supabase Auth SMTP config.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(auth): unblock first-time password set for BankID users with MFA

Supabase rejects updateUser({password}) and mfa.unenroll with "AAL2 session
is required" whenever a TOTP factor is enrolled. BankID magic-link logins
produce AAL1, and middleware skips MFA enforcement for bankid_linked users,
so they had no path to AAL2 — leaving them unable to set a backup password
or disable MFA without going through the email-recovery escape hatch.

- /api/account/password: branch on app_metadata.has_password. First-time set
  writes via service.auth.admin.updateUserById (no existing credential to
  protect, AAL2 guard does not apply). Change-password keeps the user-session
  updateUser so AAL2 still fires for credential rotation.
- /mfa/verify: accept a safeReturnTo query param and route there after
  successful verify, so step-up flows can land back where they came from.
- SecuritySettings: detect the AAL2 error from both change-password and
  mfa.unenroll and redirect through /mfa/verify?returnTo=/settings/account
  instead of toasting a dead-end error.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Add tests and rounding utility for öre precision in bokslut calculations

- Implemented `roundOre` function for rounding SEK amounts to two decimal places, ensuring consistent monetary calculations.
- Introduced `ORE_TOLERANCE` constant for comparing rounded amounts, facilitating invariant checks in financial entries.
- Created comprehensive tests for `roundOre`, covering typical cases, edge cases, and idempotency.
- Added year-end invariants tests to verify database-level guarantees for closing entries, ensuring they balance to the öre and reject discrepancies.
- Developed end-to-end tests for the dispositions chain, validating the correctness of calculations across various scenarios.

* fix: update PDF rendering to remove Swish QR code generation and set default to disable Swish visibility

* fix: enhance security by rejecting data URIs in safeReturnTo function tests

* fix: improve rounding logic in roundOre function and add customer_type migration

* fix: add customer_type column to customers and enforce CHECK constraint

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-26 22:29:41 +02:00

373 lines
12 KiB
TypeScript

/**
* Tests for receipt matcher tools and MCP Apps protocol additions
*/
import { describe, it, expect, vi, beforeEach } from 'vitest'
import {
createQueuedMockSupabase,
makeTransaction,
} from '@/tests/helpers'
// ── Mocks ──
vi.mock('@/lib/supabase/server', () => ({
createClient: vi.fn(),
createServiceClient: vi.fn().mockResolvedValue({
storage: {
getBucket: vi.fn().mockResolvedValue({ data: { name: 'documents' } }),
},
}),
}))
vi.mock('@/lib/auth/api-keys', async (importOriginal) => {
const actual = await importOriginal<typeof import('@/lib/auth/api-keys')>()
return {
...actual,
extractBearerToken: vi.fn().mockReturnValue('test-token'),
validateApiKey: vi.fn().mockResolvedValue({
userId: 'user-1',
scopes: ['transactions:read', 'transactions:write', 'customers:read', 'customers:write', 'invoices:read', 'invoices:write', 'suppliers:read', 'reports:read'],
}),
createServiceClientNoCookies: vi.fn(),
}
})
vi.mock('@/lib/bookkeeping/category-mapping', () => ({
buildMappingResultFromCategory: vi.fn().mockReturnValue({
debit_account: '6110',
credit_account: '1930',
vat_lines: [{ account_number: '2641', amount: 74.75 }],
}),
}))
vi.mock('@/lib/bookkeeping/transaction-entries', () => ({
createTransactionJournalEntry: vi.fn().mockResolvedValue({ id: 'je-123' }),
}))
vi.mock('@/lib/events/bus', () => ({
eventBus: { emit: vi.fn().mockResolvedValue(undefined), clear: vi.fn() },
}))
vi.mock('@/lib/invoices/vat-rules', () => ({
getVatRules: vi.fn(),
getAvailableVatRates: vi.fn(),
}))
vi.mock('@/lib/currency/riksbanken', () => ({
fetchExchangeRate: vi.fn(),
convertToSEK: vi.fn(),
}))
vi.mock('@/lib/reports/income-statement', () => ({
generateIncomeStatement: vi.fn(),
}))
vi.mock('@/lib/reports/kpi', () => ({
calculateGrossMargin: vi.fn(),
calculateCashPosition: vi.fn(),
calculateExpenseRatio: vi.fn(),
calculateAvgPaymentDays: vi.fn(),
}))
vi.mock('@/lib/reports/trial-balance', () => ({
generateTrialBalance: vi.fn(),
}))
vi.mock('@/lib/reports/ar-ledger', () => ({
generateARLedger: vi.fn(),
}))
vi.mock('@/lib/reports/monthly-breakdown', () => ({
generateMonthlyBreakdown: vi.fn(),
}))
vi.mock('@/lib/reports/balance-sheet', () => ({
generateBalanceSheet: vi.fn(),
}))
vi.mock('@/lib/reports/general-ledger', () => ({
generateGeneralLedger: vi.fn(),
}))
vi.mock('@/lib/reports/supplier-ledger', () => ({
generateSupplierLedger: vi.fn(),
}))
vi.mock('@/lib/reconciliation/bank-reconciliation', () => ({
getReconciliationStatus: vi.fn(),
}))
vi.mock('@/lib/bookkeeping/invoice-entries', () => ({
createInvoicePaymentJournalEntry: vi.fn(),
createInvoiceCashEntry: vi.fn(),
createInvoiceJournalEntry: vi.fn(),
}))
vi.mock('@/lib/bookkeeping/engine', () => ({
reverseEntry: vi.fn(),
}))
vi.mock('@/lib/transactions/category-suggestions', () => ({
getSuggestedCategories: vi.fn(),
}))
vi.mock('@/lib/bookkeeping/counterparty-templates', () => ({
upsertCounterpartyTemplate: vi.fn(),
findCounterpartyTemplatesBatch: vi.fn(),
formatCounterpartyName: vi.fn(),
}))
vi.mock('@react-pdf/renderer', () => ({
renderToBuffer: vi.fn(),
}))
vi.mock('@/lib/invoices/pdf-template', () => ({
InvoicePDF: vi.fn(),
brandingFromCompanySettings: vi.fn().mockReturnValue({}),
}))
vi.mock('@/lib/email/service', () => ({
getEmailService: vi.fn().mockReturnValue({ sendInvoice: vi.fn() }),
}))
vi.mock('@/lib/email/invoice-templates', () => ({
generateInvoiceEmailHtml: vi.fn(),
generateInvoiceEmailText: vi.fn(),
generateInvoiceEmailSubject: vi.fn(),
}))
vi.mock('@/lib/core/documents/document-service', () => ({
uploadDocument: vi.fn(),
}))
import { handleMcpRequest } from '../server'
import { createServiceClientNoCookies } from '@/lib/auth/api-keys'
import { eventBus } from '@/lib/events/bus'
// Helper: make a JSON-RPC request
function mcpRequest(method: string, params?: Record<string, unknown>, id: number | string = 1): Request {
return new Request('http://localhost:3000/api/extensions/ext/mcp-server/mcp', {
method: 'POST',
headers: { 'Content-Type': 'application/json', Authorization: 'Bearer test-token' },
body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
})
}
async function parseResult(response: Response) {
const json = await response.json()
return json.result
}
describe('MCP Receipt Matcher', () => {
let supabase: ReturnType<typeof createQueuedMockSupabase>['supabase']
let enqueueMany: ReturnType<typeof createQueuedMockSupabase>['enqueueMany']
beforeEach(() => {
vi.clearAllMocks()
eventBus.clear()
const mock = createQueuedMockSupabase()
supabase = mock.supabase
enqueueMany = mock.enqueueMany
vi.mocked(createServiceClientNoCookies).mockReturnValue(supabase as never)
})
// ── Protocol: initialize includes resources capability ──
describe('initialize', () => {
it('returns resources capability', async () => {
const res = await handleMcpRequest(mcpRequest('initialize', { protocolVersion: '2025-03-26' }))
const result = await parseResult(res)
expect(result.capabilities.tools).toEqual({ listChanged: false })
expect(result.capabilities.resources).toEqual({ listChanged: false })
})
})
// ── Protocol: tools/list includes _meta for receipt matcher ──
describe('tools/list', () => {
it('includes _meta.ui for gnubok_receipt_matcher', async () => {
const res = await handleMcpRequest(mcpRequest('tools/list'))
const result = await parseResult(res)
const receiptTool = result.tools.find((t: { name: string }) => t.name === 'gnubok_receipt_matcher')
expect(receiptTool).toBeDefined()
expect(receiptTool._meta).toEqual({
ui: { resourceUri: 'ui://receipt-matcher/app.html' },
})
})
it('does not include _meta for tools without it', async () => {
const res = await handleMcpRequest(mcpRequest('tools/list'))
const result = await parseResult(res)
const categorizeTool = result.tools.find(
(t: { name: string }) => t.name === 'gnubok_categorize_transaction'
)
expect(categorizeTool).toBeDefined()
expect(categorizeTool._meta).toBeUndefined()
})
})
// ── Protocol: resources/list ──
describe('resources/list', () => {
it('includes the receipt-matcher widget alongside data resources', async () => {
const res = await handleMcpRequest(mcpRequest('resources/list'))
const result = await parseResult(res)
const widget = result.resources.find(
(r: { uri: string }) => r.uri === 'ui://receipt-matcher/app.html'
)
expect(widget).toEqual({
uri: 'ui://receipt-matcher/app.html',
name: 'Receipt Matcher',
description: 'Interactive widget for matching receipts to uncategorized transactions',
mimeType: 'text/html;profile=mcp-app',
})
// Data resources (added in Stream 3 Phase 1) should also be listed.
const uris = result.resources.map((r: { uri: string }) => r.uri)
expect(uris).toContain('gnubok://company/current')
expect(uris).toContain('gnubok://capabilities')
})
})
// ── Protocol: resources/read ──
describe('resources/read', () => {
it('returns HTML for the receipt matcher', async () => {
const res = await handleMcpRequest(
mcpRequest('resources/read', { uri: 'ui://receipt-matcher/app.html' })
)
const result = await parseResult(res)
expect(result.contents).toHaveLength(1)
expect(result.contents[0].uri).toBe('ui://receipt-matcher/app.html')
expect(result.contents[0].mimeType).toBe('text/html;profile=mcp-app')
expect(result.contents[0].text).toContain('<!DOCTYPE html>')
expect(result.contents[0].text).toContain('Kvittomatchning')
})
it('returns error for unknown resource URI', async () => {
const res = await handleMcpRequest(
mcpRequest('resources/read', { uri: 'ui://unknown/thing' })
)
const json = await res.json()
expect(json.error).toBeDefined()
expect(json.error.code).toBe(-32602)
expect(json.error.message).toContain('Resource not found')
})
})
// ── gnubok_receipt_matcher tool ──
describe('gnubok_receipt_matcher', () => {
it('returns uncategorized transactions with categories and vat_treatments', async () => {
const tx1 = makeTransaction({ id: 'tx-1', description: 'ICA', amount: -150 })
const tx2 = makeTransaction({ id: 'tx-2', description: 'Consulting', amount: 15000 })
enqueueMany([
{ data: [tx1, tx2], error: null },
])
const res = await handleMcpRequest(
mcpRequest('tools/call', { name: 'gnubok_receipt_matcher', arguments: {} })
)
const result = await parseResult(res)
// Should have structuredContent for MCP Apps
expect(result.structuredContent).toBeDefined()
expect(result.structuredContent.transactions).toHaveLength(2)
expect(result.structuredContent.categories).toContain('expense_office')
expect(result.structuredContent.vat_treatments).toContain('standard_25')
// Should also have regular content
expect(result.content).toHaveLength(1)
expect(result.content[0].type).toBe('text')
})
it('returns empty array when no uncategorized transactions', async () => {
enqueueMany([{ data: [], error: null }])
const res = await handleMcpRequest(
mcpRequest('tools/call', { name: 'gnubok_receipt_matcher', arguments: {} })
)
const result = await parseResult(res)
expect(result.structuredContent.transactions).toHaveLength(0)
})
})
// ── gnubok_categorize_transaction still works after refactor ──
describe('gnubok_categorize_transaction (staging)', () => {
it('always stages the operation directly', async () => {
const tx = makeTransaction({ id: 'tx-1', amount: -500 })
enqueueMany([
{ data: tx, error: null }, // fetch transaction (preview)
{ data: { entity_type: 'enskild_firma', fiscal_year_start_month: 1 }, error: null },
{ data: tx, error: null }, // fetch transaction for title
{ data: null, error: null }, // resolvePeriodStatusForDate — company_settings
{ data: null, error: null }, // resolvePeriodStatusForDate — fiscal_periods
{ data: { id: 'op-1' }, error: null }, // insert into pending_operations
])
const res = await handleMcpRequest(
mcpRequest('tools/call', {
name: 'gnubok_categorize_transaction',
arguments: { transaction_id: 'tx-1', category: 'expense_office' },
})
)
const result = await parseResult(res)
const parsed = JSON.parse(result.content[0].text)
expect(parsed.staged).toBe(true)
expect(parsed.operation_id).toBe('op-1')
expect(parsed.message).toMatch(/staged/i)
expect(parsed.preview).toBeDefined()
expect(parsed.preview.debit_account).toBeDefined()
})
})
// ── tools/call structuredContent ──
describe('tools/call structuredContent', () => {
it('includes structuredContent for tools with _meta.ui', async () => {
enqueueMany([{ data: [], error: null }])
const res = await handleMcpRequest(
mcpRequest('tools/call', { name: 'gnubok_receipt_matcher', arguments: {} })
)
const result = await parseResult(res)
expect(result.structuredContent).toBeDefined()
expect(result.content).toBeDefined()
})
it('also includes structuredContent for regular tools (alongside the text content block)', async () => {
const tx = makeTransaction({ id: 'tx-1', amount: -500 })
enqueueMany([
{ data: tx, error: null },
{ data: { entity_type: 'enskild_firma', fiscal_year_start_month: 1 }, error: null },
{ data: tx, error: null }, // fetch transaction for title
{ data: null, error: null }, // resolvePeriodStatusForDate — company_settings
{ data: null, error: null }, // resolvePeriodStatusForDate — fiscal_periods
{ data: { id: 'op-1' }, error: null }, // insert into pending_operations
])
const res = await handleMcpRequest(
mcpRequest('tools/call', {
name: 'gnubok_categorize_transaction',
arguments: { transaction_id: 'tx-1', category: 'expense_office' },
})
)
const result = await parseResult(res)
// Modern clients consume structuredContent directly when an outputSchema is declared.
expect(result.structuredContent).toBeDefined()
expect(result.structuredContent).toMatchObject({ staged: true })
expect(result.content).toBeDefined()
})
})
})